Whenever I receive e-mails or try to visit sites like J. Crew and Anthropologie, my browser either fails to display the images on the page or the entire page itself. Instead, it automatically redirects to other pages, some URLs being:

Also, my browser/computer can no longer play .wmv videos from the internet

Finally, though I'm not sure if this arises from a mal/spyware problem, but I've noticed that my System Restore never successfully completes whenever I try to restore it to an earlier checkpoint. It always says that it cannot restore to its previous configuration. Is this a Windows difficulty and could this somehow be linked to a virus/malware?

Norton has detected a low/medium risk threatEwido/AVG has detected a high risk threat: Trojan.DNSChanger.ih

I followed the instructions in the FAQ. I ran Ad-Aware, Spybot, Ewido, HijackThis, and plan to run one or two more of the recommended online scanners while I wait for a reply.

Here are my Ewido and HijackThis logs:

**This is actually a cut down log, because the original (which I can send if needed) was about 20mb and 10 million characters (2000+ pages in Word) and had alot of redundant lines...w/ a digit or 2 between similar lines. ---------------------------------------------------------AVG Anti-Spyware - Scan Report---------------------------------------------------------+ Created at: 9:22:52 PM 6/10/2007

Welcome to SWI. We apologize for the delay; our helpers have been very busy.If you have not received help after 3 days, please CLICK HERE, and post a link to your log and the date it was originally posted.

Save it to your desktop and run it. Click Next, then Install, then make sure "Run fixit" is checked and click Finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.

When your system reboots, follow the prompts. Afterwards, HijackThis will launch. Please click Scan, and check the following items:

If you have problems with your internet connection after this fix, try this.Please go to Start -> Control Panel, and choose Network Connections. Then right click on your default connection, usually Local Area Connection or Dial-up Connection if you are using Dial-up, and left click on properties. Double-click on the Internet Protocol (TCP/IP) item and select the radio button that says Obtain DNS servers automatically. Click OK twice, and restart your computer.

If the O17 remains or you still have difficulties in getting to a site, Flush the DSN.Go start > run type cmd and hit OKtypeipconfig /flushdns <-- (The space between g and / is needed)

Then hit Enter, type Exit, hit Enter

Finally, please post the contents of the logfile C:\fixwareout\report.txt, along with a new HijackThis log.

I stumbled upon my thread while I was searching for solutions to my old problem. Whenever I ran AVG 7.5 (Ewido), a Trojan.DNSChanger.ih would always show up, no matter how many scans I ran. I googled it and through some other solutions I cleaned the registry NameServer and Dhcp entries. I also ran the Fixit.exe that you provided, as well as HJT as you requested.

Though I can now view sites that were once hijacked (i.e. Jcrew.com, anthropologie.com), I'm still not sure that my computer is virus free.Also, I'm still having problems viewing .wmv files from the web.My computer also has trouble ending some processes, even when I specifically go into the task manager and try to shut them down there. When these processes hang, my computer takes a very long time to shut down.

Thank you for the suggestion to upgrade Java. I would, except my college has asked us not to quite yet because their systems have yet to be upgraded to be compatible with Java 6.

It's also great to hear that my HJT log didn't show any problems, but when I ran AVG 7.5 last night, it still produced the Trojan.DNSChanger.ih virus. Does that mean that something is still left on my computer? Since when i fixed those registry entries, I went in manually and simply deleted those values from the registry fields.

I'm posting the log here. Actually, it's an extremely abbreviated version, because my AVG log keeps on showing hundreds of Tracking Cookie results that are a digit or two off. Does this indicate a problem, at all?

Thank you for your reply and the advice about Java and clearing my domains.

I did as you said I should, and I am no longer getting the various IE popups that used to appear.

However, my AVG 7.5 and Spybot S&D are still picking up many tracking cookies. AVG 7.5 frequently picks up 3,000+ of them. I know Tracking Cookies are not as direly threatening as many other issues, but is there any way to clean them out?

The rest are optional - if you want to remove the lot, check "Select All". Finally click Empty Selected. When you get the "Done Cleaning" message, click OK.

If you use the Firefox or Opera browsers, you can use this program as a quick way to tidy those up as well.

When you have finished, click on the Exit button in the Main menu.

For Technical Support, double-click the e-mail address located at the bottom of each menu.

* The purpose of Prefetch folder is to increase the speed at which you can access the programs that you use on your PC. Unfortunately, Windows doesn't differentiate between a program you use every day and one you use every blue moon, which means that it may be prefetching a lot of stuff that you rarely use, adding to your startup time. You may find that the first time you boot up after cleaning out this folder, your PC takes longer to get into gear - the second, and subsequent, boots should be quicker.

So I used the ATF Cleaner, but it seems more like a temporary cleaner than a permanent remover of the Tracking Cookies. When I run the cleaner, it definitely decreases the number of Tracking Cookies that show up, but when I use my browser again, more Tracking Cookie traces are found.

Is there a way to permanently remove the Tracking Cookie traces? Or is the presence of Tracking Cookies when I run AVG 7.5 not a big problem?

If you need this topic reopened, please tell the moderating team by replying here with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.